The protection of your personal data is of great importance to us. We process your data exclusively in accordance with the relevant legal provisions (in particular the General Data Protection Regulation – GDPR and the Data Protection Act – DSG). Below, we provide information on what personal data is processed in connection with the use of our website and the tim service, the purposes for which processing takes place, and the rights you have as a data subject.
1. Contact details of the joint controllers
The ‘tim Steirischer Zentralraum’ e-car-sharing service is provided by
Regionalmanagement Steirischer Zentralraum GmbH and the following operators (hereinafter referred to as ‘tim partners’ or ‘we’):
- Gemeinde Fernitz-Mellach
- Gemeinde Hart bei Graz
- Gemeinde Nestelbach bei Graz
- Gemeinde Söding-Sankt Johann
- Gemeinde Stattegg
- Marktgemeinde Feldkirchen bei Graz
- Marktgemeinde Gratkorn
- Marktgemeinde Gratwein-Straßengel
- Marktgemeinde Laßnitzhöhe
- Marktgemeinde Lieboch
- Marktgemeinde Premstätten
- Stadtgemeinde Bärnbach
- Stadtgemeinde Frohnleiten
- Stadtwerke Köflach GmbH
- Stadtwerke Voitsberg GmbH
We process your data as (joint) controllers for data processing.
An agreement to this effect, in accordance with Article 26 of the GDPR, has been concluded.
Under this agreement, Regionalmanagement Steirischer Zentralraum GmbH, FN 429815g, is the central point of contact for all data protection matters relating to the tim partners, in particular regarding your rights as a data subject.
Our contact details:
Regionalmanagement Steirischer Zentralraum GmbH
Joanneumring 14, 3rd floor, 8010 Graz
office@zentralraum-stmk.at
+43 664 18 14 06 7
Managing Director:
Mag.a Kerstin Weber
2. What data is processed?
The following data is processed:
Master data
- Title
- First name and surname
- Address
- Email address
- Telephone numbers
- Date of birth
- Gender
- Nationality
We collect this personal data as part of the registration process, which is a prerequisite for booking vehicles.
Identification data
- Passport details
- customer number
- username
- public transport ticket details
- driving licence details
We collect this personal data as part of the registration or sign-up process for booking vehicles.
Payment details
- Payment method
- Account holder (first name, surname, address, email address)
- Credit or debit card details (cardholder, card issuer, IBAN, BIC, expiry date, security code)
- Creditworthiness data
We collect this personal data as part of the registration process for booking vehicles
Vehicle usage data
- Vehicle GPS location
- odometer reading
- distance travelled
- fuel level/charge status
- booking details (scheduled booking)
- start and end times of the booking
- start and end points of individual journeys within the booking (street from/street to)
We collect this personal data as part of the booking process for vehicles or the use of a booked vehicle.
3. For what purpose and on what legal basis is data processed?
Data processing is carried out for the following purposes:
- Conclusion of contracts
- Document and contract management
- Contract administration, implementation and billing of membership and bookings
- Fulfilment of data protection obligations
- Conducting relevant communication
- Providing suitable booking software
- Ensuring operations, security and fraud prevention
- Handling claims and complaints
- Analysis, evaluation of user behaviour for research purposes, to evaluate and strategically develop the service
- Contacting users for marketing purposes
- Compliance with legal obligations under the Intelligent Transport Systems (ITS) Act
The provision of your personal data is necessary for the performance of the contract. Failure to provide your personal data could mean that it is not possible to conclude the contract or to fulfil the terms of the contract.
The legal basis for the processing of your master data, identification data, payment data and vehicle usage data is therefore the performance of or steps taken prior to entering into a contract (Article 6(1)(b) of the GDPR), the legitimate interest in improving our services, in protecting the vehicles from damage or unauthorised or improper use, and in the asserting, exercising or defending legal claims (Article 6(1) (f) of the GDPR), and, in the event of contact with customer service or contact with users for marketing purposes, your consent within the framework of the General Terms and Conditions (Article 6(1)(a)). Where we are subject to a legal obligation which requires the processing of personal data, such as to fulfil tax obligations or obligations to provide information to public authorities, the processing is based on Article 6(1)(c) of the GDPR.
4. To whom do we disclose your data?
a. Categories of recipients
In order to fulfil the purposes described in point 3 above, your data may be disclosed to the following categories of recipients:
- Prime Mobility & Consulting GmbH, for customer service, contract processing and service communications, as well as for statistical evaluations and analyses
- Energie Steiermark AG, for customer service
- Holding Graz – Kommunale Dienstleistungen GmbH and ibiola mobility solutions GmbH, for the technical operation and administration of the booking platform
- public authorities, where there is a legal obligation or authorisation to do so (e.g. as part of a driver survey or for law enforcement purposes)
- research institutions such as Graz University of Technology or ALP. Lab GmbH, for the analysis and evaluation of user behaviour for research purposes, and for the evaluation and strategic development of the service
b. Transfer of data abroad
There are no plans to transfer your personal data to a third country or an international organisation.
5. How long do we retain your personal data?
Unless otherwise specified in this privacy policy, we do not retain your data for longer than is necessary to fulfil the processing purposes described in point 3 above or to fulfil our contractual or statutory obligations. The Data is therefore retained for as long as the purpose of the processing requires, or for as long as applicable law prescribes (i.e. for the duration of statutory retention obligations) or permits (i.e. until the expiry of limitation periods for potential legal claims or for as long as a legitimate interest on our part exists).
6. Rights of data subjects
Under current legislation, as a data subject, you have the right at any time, with regard to the data we process about you, to access the data we process about you, rectification of inaccurate data, data portability, restriction of processing, and erasure (‘right to be forgotten’).
Where your data is processed on the basis of our legitimate interest, you also have the right, on grounds relating to your particular situation, to object at any time to the processing of data concerning you.
Where the processing of your data is based on your consent, you also have the right to withdraw your consent at any time with effect for the future. Such a withdrawal does not affect the lawfulness of the data processing carried out up to that point.
To exercise your rights as set out above, please contact us using the contact details provided in point 1 above.
If you believe that our processing of your data contravenes applicable data protection law or that your data protection rights have been infringed in any other way, please contact us using the contact details provided in point 1 above, so that we may be made aware of your concerns and address them appropriately. You also have the right to lodge a complaint with a competent supervisory authority (in Austria: the Austrian Data Protection Authority).
